There is a big problem in your company, organisationally speaking. You are not tracking the hours your employees work, and now you are surprised that you didn't see a backlog of overtime coming. One could very easily argue that this is a problem of your own making.
"we don't track hours. We expect all employee to be flexible and manage their time so that they don't work more or less"
This is a problem of your own making then, as the company chose to not follow up on work time. If you'd said the same about the money kept in the registers; would it then be surprising if at the end of the year you suddenly realize some of the money is missing?
Expectation from company is to report the 40 hours/ week for tasks, no more or less.
While this can be interpreted to mean that overtime was not permitted, which swings this issue in your favor, I have some concern over the phrasing that the expectation is to report 40 hours, not to work 40 hours. That is a significant difference.
Some companies enforce strict hour reportings, even if the reality is more flexible. I have worked at several companies where hours were flexible (40h per week, worked whenever), but the expectation was to report exactly 8 hours every day, even if that was not the reality.
In that sense, it can be argued that your company's expectation is not about the hours effectively worked, but about the way in which regular working hours are booked.
Work is done in sprints with task items, managed by the team on an online platform. That is the place to monitor work. That board unfortunately does not tell me who worked how many hours a week.
So in essence your company does not differentiate between work spent on a project and time worked? I.e. there is no accounting for non-billable time spent, ever?
Because if there isn't, I'm not surprised that staff would be working overtime at a regular rate. It starts suggesting that this staff member was more true to their billable project hours compared to the ones who didn't clock overtime.
Furthermore, using sprints supports the employee's argument that the overtime is warranted. You assigned them a certain amount of work (the sprint load) by a certain deadline (the sprint end).
With no further time management from your end, and with employees being left to manage themselves and their own time, it is perfectly reasonable that an employee would work overtime to ensure the scheduled work is delivered by the scheduled deadline.
As to the legalities, I am not a lawyer. I don't know if you can stiff this employee (fully or partially), or if the employee can force you to pay the overtime, or if you are able to offer alternate solutions (e.g. time off instead of extra pay).
But if you approach this topic in any way that isn't agreeable to the employee in question, be very wary of the impact this is going to have on your entire team. If you stiff her in any way, word is going to reach the other team members and you are likely to never get anyone to work any amount of overtime ever again nor go beyond their described role, without first asking for written confirmation that it will be paid out.
Even if you would pay it out in those future cases, it's going to put a strain on team morale.
The lesson learned
What you should take away from this experience is that you should have pro-actively managed this, instead of leaving it up to blind assumption. You should have either explicitly prohibited overtime or capped it, and you should definitely follow up on worked hours more than once a year.
Since any impact on morale is an issue to you, and if you believe the employee's claim to be genuine, it might be better here to simply pay her for her overtime and make it clear to the team that from this point on, no overtime is permitted unless permission was explicitly given.